CVE-2024-54756 in GZDoom
Summary
by MITRE • 02/21/2025
A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code via supplying a crafted PK3 file containing a malicious ZScript source file.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/31/2025
The vulnerability CVE-2024-54756 represents a critical remote code execution flaw within the ZDoom Team GZDoom v4.13.1 game engine that fundamentally compromises system security through its ZScript function implementation. This vulnerability exists in the way the software processes PK3 archive files containing malicious ZScript source code, creating an attack vector that allows remote adversaries to execute arbitrary commands on systems running affected versions of the engine. The flaw specifically targets the ZScript interpreter component that handles script execution within the game environment, making it particularly dangerous as it can be triggered through standard game file distribution mechanisms.
The technical exploitation of this vulnerability stems from insufficient input validation and sanitization within the ZScript processing pipeline. When a malicious PK3 file containing crafted ZScript code is loaded by GZDoom, the engine fails to properly validate the script content before execution, allowing attackers to inject and run arbitrary code with the privileges of the running application. This represents a classic buffer overflow or injection vulnerability pattern that has been documented in similar contexts within the CWE database under categories related to improper input validation and code injection. The vulnerability is particularly concerning because ZScript files are commonly distributed as part of game modifications and custom content, making the attack surface expansive and difficult to monitor.
The operational impact of CVE-2024-54756 extends beyond simple remote code execution to encompass complete system compromise capabilities. Attackers can leverage this vulnerability to install backdoors, exfiltrate sensitive data, or establish persistent access to compromised systems. The attack requires only that a user loads a malicious PK3 file, which can be delivered through various means including game mod distribution sites, peer-to-peer networks, or social engineering campaigns. This vulnerability directly maps to ATT&CK technique T1059.007 for scripting languages and T1203 for legitimate credentials, as it enables attackers to execute commands through the game engine's scripting interface. The implications are severe for gaming communities and developers who rely on ZDoom for modding and custom content creation.
Mitigation strategies for this vulnerability must address both immediate defensive measures and long-term architectural improvements. System administrators should immediately disable PK3 file loading capabilities or implement strict file validation mechanisms to prevent execution of untrusted content. The recommended approach involves implementing sandboxing techniques that isolate ZScript execution environments from system resources and implementing strict content filtering that validates all PK3 file contents against known good signatures or safe execution patterns. Organizations should also consider implementing network-level controls that prevent access to known malicious mod distribution sites and establish secure content verification processes for all game modifications. The vulnerability highlights the importance of secure coding practices and input validation, aligning with CWE guidelines for preventing injection flaws and maintaining proper privilege separation in interpreted scripting environments.